1. Field of the Invention
The present invention generally relates to an implementation of a public key cryptographic mechanism based on the characteristics of those processes that allow cooperating parties to create information between them that is, on average, corrupted by errors but is far less corrupted than an estimate of that information gleaned by an interloping interested party. The problem solved is the establishment of a secret between two parties who must carry out all communications over a channel that can be monitored by any interested party. The goal is more specific in that the invention provides a privacy cryptographic mechanism and implementation that guarantees that an interloper must perform an average amount of work to recover the secret that is much greater than the amount of work required to create the secret between the two parties. Thus, while the invention does not afford high grade cryptographic security for information requiring long term protection, it is useful in situations where protection of time sensitive information is required. In some applications, it may be necessary to provide only a few seconds of protection.
2. Description of the Prior Art
In classical cryptography, it is a primary tenet that the opposition is presumed to be in possession of the encryption algorithm and that system security rests on a single secretly held keying variable. This keying variable must be securely distributed to the parties involved prior to the commencement of secure communications. Distribution, protection, and control of these keying variables falls under the rubric of keying variable management. The pressure and pace of modern communications requirements has elevated keying variable management to an extremely important and high visibility aspect of almost every modern secure communications system.
It is for these reasons that public key, or two key, cryptography has captured the attention and imagination of the secure communications system architect. For with public key cryptography, it is possible under many actual situations to generate keying variables electronically and securely over unprotected communication channels. That such a concept was indeed possible was publicly posited by R. Merkle in "Secure Communications Over Insecure Channels", Communications of the ACM, vol. 21, pp. 294-299 (1978), which is incorporated herein by reference.
In Merkle's system, the two parties that wish to create a secret between them do so by Party A's creating N puzzles and sending them to Party B. A puzzle is a set of mathematical work that requires, on average, a certain number of trials to solve. A simple cryptographic system would qualify as a puzzle and could be realized, as suggested by Merkle, out of the Data Encryption Standard (DES) as promulgated by the then National Bureau of Standards in Federal Information Processing Standards Publication number 46 (1977). The way that the DES could serve as a puzzle would be to operate it in a reduced key space; i.e., by publicly announcing that a significant number of specific keying variable bits would be preset to publicly announced values and that the puzzle would be to correctly determine the remaining keying variable bits which were randomly picked by the puzzle maker. Solution would be indicated to the puzzle solver by the successful decryption of a checkword which is the encryption of a known, publicly announced plaintext word. The puzzle also has as its plaintext a puzzle number and a keying variable that is to be used for further communication.
Proceeding on, Party A sends the created puzzles to Party B in random order. Party B selects one puzzle at random and solves it. Party B then informs Party A of the puzzle number that it has solved, and then Parties A and B communicate using a standard or classical cryptographic system that is keyed by the keying variable which has also been provided by the solved puzzle.
The security assessment of the Merkle system shows that if it takes S units of work to solve any one puzzle, on the average, and if Party A has sent N puzzles, then Party B has to perform S units of work, but an interloper has to perform, on the average, (N/2)S units of work. If N is on the order of S, then the interloper has to perform, on the average, O(S.sup.2) work units, where O() is the usual mathematical "order" expression.
Public Key Cryptographic Systems have been devised that require the interloper to perform work on the average that grows not as a square but exponentially. Such a system was announced by W. Diffie and M. Hellman in "Privacy and Authentication: An Introduction to Cryptography", Proceedings of the IEEE, Vol. 67, pp. 397-497 (1979), which is incorporated herein by reference. In the Diffie-Hellman system, two Parties, A and B, are allowed to create a mutually held secret quantity which could be used, for example, as a keying variable for a one key classical cryptographic system. The Diffie-Hellman system is summarized below:
______________________________________ PARTY A PARTY B ______________________________________ Picks a secret number X Picks a secret number Y Calculates r.sup.y mod p and sends it Calculates r.sup.Y mod p and sends to Party B it to Party A Receives r.sup.x mod p and raises it Receives r.sup.x mod p and raises to the X power reducing result it to the Y power reducing mod p mod p ______________________________________
In the Diffie-Hellman system, p, a large prime number, is publicly known as well as r, a primitive root of p. After performing the steps outlined above, both Parties, A and B, possess r.sup.XY mod p (without either party knowing, or needing to know, the other's secret number). A passive interloper, i.e., a party monitoring only the exchanges between Parties A and B, could calculate r.sup.XY mod p if able to solve for either X or Y. The cryptosecurity strength of the Diffie-Hellman system is thus no stronger than the apparently significant asymmetric complexity between performing exponentiation (which is relatively easy) and solving the discrete logarithm problem (which is relatively hard) in various finite fields.
Exponentiation requires O(log.sub.2 p) work. R. Merkle and L. Adleman have independently devised an algorithm that will compute discrete logarithms with work o(e.sqroot.k(lnp)(ln(lnp))) Thus, the ratio of work required to take logarithms to the work to exponentiate is extremely large providing that the Merkle/Adleman procedure is nearly optimal. See, for example, R. Merkle, Secrecy, Authentication, and Public Key Systems, Ph.D. dissertation, Department of Electrical Engineering, Stanford University (Jun., 1979), and L. Adleman, "A Subexponential Algorithm for the Discrete Logarithm with Applications to Cryptography", Proceedings of the 20th Annual Symposium on foundations of Computer Science (Oct. 29-31, 1979), both of which are incorporated herein by reference. To promote confidence in the discrete logarithm problem, p should be very large, perhaps hundreds of digits long. Execution of this particular public key system, and most public key systems, entails a large computational overhead. In addition, the minimum cost of performing the discrete logarithm problem is not known nor is it known that there is no attack better than by attempting to take the discrete logarithm.
In the patented literature, the following U.S. patents are considered relevant prior art. U.S. Pat. No. 4,200,770 to Hellman et al. discloses a cryptographic apparatus and method. U.S. Pat. No. 4,218,582 to Hellman et al. discloses a public key cryptographic apparatus and method. U.S. Pat. No. 4,424,414 to Hellman et al. discloses an exponentiation cryptographic apparatus and method. U.S. Pat. No. 4,405,829 to Rivest et al. discloses a cryptographic communications system and method. The Rivest et al. patent discloses the so-called RSA (for Rivest, Shamir and Adleman, the inventors) algorithm, a well-known public-key algorithm. A discussion of the RSA and other public-key algorithms may be had by reference to C. Meyer and S. Matyas, Cryptography: A New Dimension in Computer Data Security, Wiley (1982). See also J. Hershey and R. Yarlagadda, Data Transportation and Protection, Plenum Press (1986).